Recent advances in adversarial learning has broken the phantasm of high-performing DL models. An adversarial example, created using attacks of adversarial learning, is a sample of modified inputs (image, text, audio, etc.) that can force a model to misbehave. These attacks corrupt DL models by injecting tiny amount of imperceptible noise into the input and generates original input look-alike adversarial examples. These examples pose a potential security threats for practical applications of DL. Engstrom et al. showed that deep CNN models can be forced to do misclassification by attacking with some easy geometric transformations. This phenomena of performance degradation has been noticed for several dataset including MNIST, CIFAR10, and ImageNet (26% drop for MNIST, 72% drop for CIFAR10, and 28% drop for ImageNet)[1]}. In another research, Ian Goodfellow and his fellow authors introduced to Fast Gradient Sign Method using a maxout network to generate adversarial examples which produces 89.4% misclassification with 97.6% confidence [2]}. Li et al. in their work compared the performance of original testing data with a new type of adversarial examples [3]}. Su et al. invented one pixel attack where they have shown that changing a single pixel of input images can cause 70.97% of misclassification [4]}. Zajac and his fellow researchers have focused on attacking the border of images [5]}. These examples, and many others, have demonstrated DL models are not robust to the attacks, which is harmful to the applications especially in health area.
<FIGURE>